Fix: Ensure JWTValidator handles GUESS algorithm with JWKS

[henry3260]

What

• Algorithm Detection: The alg is now dynamically read from the JWT header instead of relying on a predefined or mismatched algorithm.
• Key Handling: The raw key (key.key) is passed directly to the jwt.decode function, avoiding conflicts caused by the PyJWK object enforcing its internal algorithm_name.

[Copilot]

Pull request overview

This PR updates the FastAPI JWT auth implementation so JWTValidator can validate tokens when [api_auth] jwt_algorithm = GUESS is used together with a configured JWKS (local/remote), and adds a unit test to cover that configuration.

Changes:

• Allow JWTValidator to be constructed with algorithm=["GUESS"] when jwks is configured (previously rejected).
• During validation, infer the concrete algorithm when using JWKS+GUESS so jwt.decode() can proceed.
• Add a unit test exercising JWKS validation with jwt_algorithm=GUESS for RSA and Ed25519 keys.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
airflow-core/src/airflow/api_fastapi/auth/tokens.py	Adjust JWT validation to support GUESS with JWKS by inferring an algorithm at decode time.
airflow-core/tests/unit/api_fastapi/auth/test_tokens.py	Add regression test for JWKS validation when jwt_algorithm is set to GUESS.

---

You can also share your feedback on Copilot code review. Take the survey.

[SameerMesiah97]

I think there may be a security concern here because this loosens the restriction on what party decides the verification algorithm. I have left a comment at the most critical line.